SSL/TLS

What SSL/TLS protects

TLS provides three protections for data moving between a client and server:

• Confidentiality: encryption stops anyone without the session keys from reading the content.
• Integrity: authenticated encryption detects application data altered in transit.
• Server authentication: a certificate helps the client confirm that it reached the requested domain.

A successful TLS handshake combines certificate validation with proof that the server holds the corresponding private key, authenticating it for the domain and establishing encryption. It doesn’t prove that the website itself is trustworthy.

How a TLS connection works

For HTTPS over TCP, the TLS handshake starts after the TCP connection opens:

1. The client sends a ClientHello with supported TLS versions and cryptographic options.
2. The server selects compatible options and sends its certificate.
3. The client checks the certificate’s domain, expiration date and chain of signatures.
4. Both sides derive session keys, then exchange encrypted application data.

For example, before a browser sends GET / HTTP/1.1 to https://example.com, it normally connects to port 443 and completes this handshake.

SSL vs TLS

People still say “SSL certificate,” but websites now use that certificate with TLS. SSL survives mainly as an informal name for encrypted web connections.

How TLS works through a proxy

With an HTTP proxy, an HTTPS client usually asks the proxy to open a tunnel:

CONNECT example.com:443 HTTP/1.1
Host: example.com:443

The TLS handshake then passes through that tunnel. The proxy can see the destination and connection metadata such as timing and byte counts, but a standard tunnel can’t read encrypted HTTP headers or bodies. The website traffic inside the tunnel stays encrypted end to end. What a plain HTTP proxy leaves unencrypted is the CONNECT request itself, including any proxy credentials; an HTTPS proxy encrypts that client-to-proxy hop too.

A proxy performing TLS inspection terminates the client’s TLS connection and creates a second one to the website. The client must trust the proxy’s certificate authority for this to work.

Using a proxy changes the source IP the website sees, not the client’s TLS behavior. Sites may still classify clients through TLS fingerprinting, which examines handshake details such as extension order and supported algorithms.

FAQ

Is SSL the same as TLS?

No. SSL is the obsolete predecessor to TLS. The term “SSL” is still commonly used when people mean TLS or an HTTPS certificate.

Can a proxy read HTTPS traffic?

Usually not when it only carries a TLS tunnel. A proxy can read the content if it terminates TLS and your device trusts the certificate it presents.

Does SSL/TLS hide my IP address?

No. TLS encrypts application data but doesn’t hide routing information. Without a proxy, the website sees your public IP; with a proxy, it sees the proxy’s exit IP.